This sophisticated attack arrived in user’s inbox as an email from a trusted contact & asked users to check out the attached “Google Docs,” file and if users click the “Open in Docs” button in the email, it takes users to a legitimate Google sign-in screen asking them to “continue in Google Docs”.

On clicking that link it grants permission to a malicious third-party application to possibly access the contacts and emails, which spread spam to additional contacts also. The attacks were simple, but sinister and wreak disaster for millions of Gmail users. The link seny by hackers looked remarkably real and trustworthy as the email that delivered is coming from someone users already know — and the payload manipulated Google’s real login system.

In an official statement, Google has confirmed that it has now fixed the phishing attack. “We have taken action to protect users against an email impersonating Google Docs, and have disabled offending accounts,” says a Google spokesperson. “We’ve removed the fake pages, pushed updates through Safe Browsing, and our abuse team is working to prevent this kind of spoofing from happening again.”

In another statement issued late Wednesday night, Google assured its users that, beyond contact information, no other sensitive data was obtained from the attack and no further action is necessary to protect accounts.